E-Discovery for Everybody: The EDna Challenge - Craig Ball
E-Discovery for Everybody: The EDna Challenge - Craig Ball
E-Discovery for Everybody: The EDna Challenge - Craig Ball
Create successful ePaper yourself
Turn your PDF publications into a flip-book with our unique Google optimized e-Paper software.
4. Expand files that hold messages and other files. Here, you should identify e-mail<br />
container files (like Outlook .PST files) and archives (e.g., .Zip files) that must be<br />
opened or decompressed to make their constituents amenable to search. For email,<br />
this can be done using an inexpensive utility like Aid4mail from Fookes<br />
Software or Trident Lite from Wave Software. Additionally, e-mail client<br />
applications, including Outlook, usually permit export of individual messages and<br />
attachments. Though dtSearch includes a command line utility to convert<br />
Outlook PST container files to individual messages (.MSG) files <strong>for</strong> indexing, it<br />
doesn't work well or easily compared to Aid4Mail. Finally, most indexing tools<br />
are capable of directly accessing text within compressed <strong>for</strong>mats. For example,<br />
DTSearch can extract text from Zip files and other archives.<br />
5. A feature common to premium e-discovery tools but hard to match with off-theshelf<br />
software is deduplication. You can use hash values to identify identical<br />
files, but the challenge is to keep track of all de-duplicated content and reliably<br />
apply tagging <strong>for</strong> privilege and responsiveness to all deduplicated iterations.<br />
Most off-the-shelf utilities simply eliminate duplicates and so aren't suited to ediscovery.<br />
This is where it's a good investment to secure help from an expert in Microsoft<br />
Excel or Access because those applications can be programmed to support<br />
deduplication tracking and tagging.<br />
When employing deduplication, keep in mind that files with matching hash values<br />
can have different filenames and dates. <strong>The</strong> hash identicality of two files speaks<br />
to the contents of the files, not the names assigned to the files by the operating<br />
system or to in<strong>for</strong>mation, like modified, accessed and created dates, stored<br />
outside the files.<br />
6. Above all, don't process and review ESI in a vacuum. Be certain that you<br />
understand the other side's expectations in terms of the scope of the ef<strong>for</strong>t,<br />
approach to search and--critically--the <strong>for</strong>ms of production they seek. You may<br />
not agree on much, but you may be pleasantly surprised to learn that some of the<br />
perils of a low budget e-discovery ef<strong>for</strong>t (e.g., altered metadata, limited search<br />
capabilities, native production <strong>for</strong>mats) don't concern the other side. Further, you<br />
may reach accord on limiting the scope of review in terms of time intervals,<br />
custodians and types of data under scrutiny. Why look at all the e-mail if the<br />
other side is content with your searching just communications between Don and<br />
Betty during the third week of January 2009?<br />
Finally, Edna may seek an answer to two common questions from those taking the doit-yourself<br />
route in e-discovery:<br />
What if I change metadata?<br />
Certain system metadata values--e.g., last access times and creation dates--are prone<br />
to alteration when processed using tools not designed <strong>for</strong> e-discovery. Such changes<br />
are rarely a problem if you adhere to three rules: